CVE-2023-4863: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2023-09-13
EPSS: 100.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-12 · updated 2026-06-17
Weakness: CWE-787

Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Affected products

Bandisoft Honeyview: before 5.51 — fixed in 5.51
Bentley Seequent Leapfrog: before 2023.2 — fixed in 2023.2
Debian Linux: 10.0, 11.0, 12.0
Fedoraproject Fedora: 37, 38, 39
Google Chrome: before 116.0.5845.187 — fixed in 116.0.5845.187
Microsoft Edge (Chromium): before 116.0.1938.81 — fixed in 116.0.1938.81
Microsoft Teams: before 1.6.00.26463; before 1.6.00.26474 — fixed in 1.6.00.26463, 1.6.00.26474
Microsoft WebP Image Extension: before 1.0.62681.0 — fixed in 1.0.62681.0
Mozilla Firefox: before 102.15.1; before 117.0.1; from 115.1.0 before 115.2.1 — fixed in 102.15.1, 115.2.1, 117.0.1
Mozilla Thunderbird: before 102.15.1; from 115.0 before 115.2.2 — fixed in 102.15.1, 115.2.2
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
Chromium libwebp: before 1.3.2 — fixed in 1.3.2
Crates.Io Libwebp-Sys: before 0.9.3 — fixed in 0.9.3
Crates.Io Libwebp-Sys2: before 0.1.8 — fixed in 0.1.8
Crates.Io Webp: before 0.2.6 — fixed in 0.2.6
Go Github.Com/Chai2010/Webp: from 1.1.2 before 1.4.0; before 0.0.0-20250406010349-76805d5a8860; from 0.0.0 before 1.1.2-0.20250406010349-76805d5a8860 — fixed in 1.4.0, 0.0.0-20250406010349-76805d5a8860, 1.1.2-0.20250406010349-76805d5a8860
Npm Electron: from 22.0.0 before 22.3.24; from 24.0.0 before 24.8.3; from 25.0.0 before 25.8.1; from 26.0.0 before 26.2.1; from 27.0.0-beta.1 before 27.0.0-beta.2 — fixed in 22.3.24, 24.8.3, 25.8.1, 26.2.1, 27.0.0-beta.2
Nuget Magick.Net-Q16-Anycpu: before 13.3.0; 10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2 (+178) — fixed in 13.3.0
Nuget Magick.Net-Q16-Hdri-Anycpu: before 13.3.0; 10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2 (+175) — fixed in 13.3.0
Nuget Magick.Net-Q16-X64: before 13.3.0; 10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2 (+194) — fixed in 13.3.0
Nuget Magick.Net-Q8-Anycpu: before 13.3.0; 10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2 (+178) — fixed in 13.3.0
Nuget Magick.Net-Q8-Openmp-X64: before 13.3.0; 10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2 (+75) — fixed in 13.3.0
Nuget Magick.Net-Q8-X64: before 13.3.0; 10.0.0, 10.1.0, 11.0.0, 11.1.0, 11.1.1, 11.1.2 (+194) — fixed in 13.3.0
Nuget Skiasharp: from 2.0.0 before 2.88.6; 2.80.0, 2.80.1, 2.80.2, 2.80.3, 2.80.4, 2.88.0 (+5) — fixed in 2.88.6
Pypi Pillow: before 10.0.1; 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+87) — fixed in 10.0.1
Google Chrome: from 116.0.5845.187 before 116.0.5845.187 — fixed in 116.0.5845.187
Google libwebp: from 1.3.2 before 1.3.2 — fixed in 1.3.2

How to fix

Upgrade to a fixed version: Bandisoft Honeyview 5.51; Bentley Seequent Leapfrog 2023.2; Google Chrome 116.0.5845.187; Microsoft Edge (Chromium) 116.0.1938.81; Microsoft Teams 1.6.00.26463, 1.6.00.26474; Microsoft WebP Image Extension 1.0.62681.0; Mozilla Firefox 102.15.1, 115.2.1, 117.0.1; Mozilla Thunderbird 102.15.1, 115.2.2; Chromium libwebp 1.3.2; Crates.Io Libwebp-Sys 0.9.3; Crates.Io Libwebp-Sys2 0.1.8; Crates.Io Webp 0.2.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4863 or the next vulnerability affects your stack